So with a quick search online, I found this site: https://incountry.com/blog/data-residency-laws-by-country-overview/ https://incountry.com/blog/data-residency

So with a quick search online, I found this site: https://incountry.com/blog/data-residency-laws-by-country-overview/ https://incountry.com/blog/data-residency-laws-by-country-ov... Organisations which receive and hold any of regulated data types to follow the GDPR requirements. According to GDPR, companies have to keep the data secure inside the EU and if the data is to be transferred outside of the UE, then it can only be transferred to countries or organisations that have signed up to equivalent privacy protection." So the EU has all the power here to say that the UK doesn't meet their standards and require businesses to transfer their data. However, I would guess that most international organisations would have already moved their EU customer data out of the UK. There were years of uncertainty with the Brexit negotiations, keeping data in the UK would have too much risk. Plus many other countries have data residency laws, so it's not like a foreign concept to international businesses.